diff --git a/deploy/2026.08.28.01.md b/deploy/2026.08.28.01.md
new file mode 100644
index 00000000..29625555
--- /dev/null
+++ b/deploy/2026.08.28.01.md
@@ -0,0 +1,71 @@
+# 2026.08.28.01
+
+**One feature: sign in as a user, from user management.** Owner-only, one hour, on a token that carries
+`impersonatedBy` so an impersonated action is never mistaken for the person's own.
+
+Two commits since `2026.08.27.02`, one of which is that release's own report.
+
+## No schema change. No dependency change. No plugin change.
+
+Checked, not asserted — `git diff --name-only deploy/2026.08.27.02..HEAD` matches no `schema.ts`, no
+`drizzle` config, no `bun.lock`, and nothing under `plugins/`. That was the claim the `2026.08.27.01`
+plan got wrong, so it is stated here as a check that was run rather than a belief.
+
+## `bun db:push` is deliberately NOT a step
+
+Every previous plan ran it "because it is cheap and proves the database agrees with the code". The
+`2026.08.27.02` report showed it proves nothing of the sort: it prints **"Changes applied" even when it
+applies nothing**, including on a second run against an unchanged database. And on this fleet it is not
+free — every host re-applies a default on `command_hq_sessions.reference_paths`, and `alpha` and
+`edge-pertento-bridge` drop and re-add `pk_music_now_playing`, which is the drizzle-kit composite-key
+mis-diff in `src/databases/CLAUDE.md`.
+
+Nothing in this release touches a schema, so running it would be churn against a database for no reason,
+using a command whose output cannot be checked. **If you run it anyway, it is not evidence of anything.**
+
+`bun run plugins:update` is skipped for the same reason: no plugin changed, and `2026.08.27.02` updated
+them across the fleet yesterday.
+
+## Every host
+
+1. `git fetch origin --tags` then `git merge --ff-only deploy/2026.08.28.01`
+2. `pm2 restart officer`
+
+That is the whole rollout. The change is a route and a frontend bundle; nothing else runs it.
+
+**`macbookpro`:** prepend `/opt/homebrew/bin` to PATH for `bun`; run `pm2` separately. Asleep is a skip
+with a note.
+
+**`deadpool-rezio-bridge`:** login `br`, checkout `/home/br/officerdev/platform`. Its SSH is intermittent
+— it refused once during the `2026.08.27.02` survey and answered minutes later. One retry, not a loop.
+
+**Do not restart `officer-claude-code`** — it ends every live agent session on the host and nothing here
+needs it. **`officer-opencode` does not need a restart either**: this release changes nothing it reads at
+boot.
+
+## Verify, per host
+
+The feature is owner-only, so an unauthenticated probe proving the route EXISTS is the honest check —
+401 or 403 means mounted, 404 means the bundle did not move:
+
+```
+curl -s -o /dev/null -w '%{http_code}\n' -X POST http://127.0.0.1:<port>/api/users/1/impersonate
+```
+
+Expect **401**. A **404** means step 2 did not take effect. Ports are in `docs/servers.md` —
+`macbookpro` and `production-pertento-bridge` are on **9010**, everything else 9000.
+
+## Risk
+
+Low. One new route behind the existing owner gate, and one frontend bundle. The route refuses a
+self-impersonation, an unknown user, a non-Active account, and any caller whose own token is already
+impersonated — that last one is what stops it chaining into owner powers.
+
+Nothing to roll back but the merge: no data is written and no schema is touched.
+
+## Hosts
+
+alpha · fofos · macbookpro · macbruno · production-pertento-bridge · edge-pertento-bridge ·
+deadpool-rezio-bridge
+
+`officer-dev` is skipped: it is the host running the rollout, and it is already at this code.
diff --git a/package.json b/package.json
index 0a52016a..76465d5b 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "officer",
-  "version": "2026.08.27.02",
+  "version": "2026.08.28.01",
   "private": true,
   "type": "module",
   "workspaces": [